CNCDP study plan

Map each layer of a reference enterprise architecture (perimeter, DMZ, segmentation, endpoint, identity, cloud) to the specific control that enforces least privilege at that layer

Compare three segmentation approaches (VLAN-based, firewall-chokepoint, zero-trust micro-segmentation) and state for each the attack path it blocks and the operational cost it adds

Build a written threat-actor profile for one named ransomware group and one nation-state APT, listing their initial-access techniques, tooling, and observable indicators

Explain how the MITRE ATT&CK Enterprise matrix maps to defensive control categories, giving one concrete control for three different tactics

Diagram the kill chain for a supply-chain compromise and annotate where detection opportunities exist

Design a defense-in-depth stack for a hybrid environment and justify each layer's placement using an explicit threat it addresses

Configure and validate a host-based or network-based detection rule (e.g., a SIEM correlation rule or IDS signature) against a safe test case, then document tuning decisions

Distinguish true-positive, false-positive, and benign-true-positive outcomes using three concrete examples from log data

Describe how log sources (EDR, proxy, DNS, authentication, cloud audit) complement each other during a single intrusion timeline

Select log-retention and time-synchronization requirements that would keep an investigation viable after a 60-day dwell time

Write three hypothesis-driven hunts, each stating the hypothesis, the data required, the query logic, and the expected false-positive rate

Execute at least one hunt against a lab dataset and record what the data did and did not show

Convert one successful hunt into a durable analytic with a documented detection threshold

Build a triage decision tree that takes an alert from ingestion to escalation or closure in defined steps

Identify which ATT&CK techniques your current telemetry cannot detect and state the data source each gap requires

Run an authenticated vulnerability scan against a lab host, then prioritize findings using exploitability, exposure, and asset criticality rather than raw CVSS score

Draft a remediation plan that sequences patching, compensating controls, and risk acceptance with named owners and target dates

Write an incident-response playbook for one scenario (e.g., credential theft or ransomware) with phases, decision points, and communication triggers

Define severity-classification criteria and the escalation matrix that follows from each severity

Rehearse the playbook as a tabletop exercise and record where the written steps broke down

Assemble an evidence-collection checklist covering volatile data, disk images, memory, and cloud logs, with the order of volatility applied

Demonstrate chain-of-custody documentation from seizure through storage, including hashing and integrity verification

Explain how to preserve evidence in a live cloud environment where you cannot power down the host

Identify the legal and policy constraints (privacy, consent, jurisdiction) that shape what you may collect

Produce a forensic report section that states findings, methods, and limitations without overstating conclusions

Reconstruct an intrusion timeline from mixed log sources and identify the earliest reliable detection point

Write containment, eradication, and recovery criteria that are testable rather than aspirational

Draft a post-incident review that separates root cause, contributing factors, and detection gaps

Design a threat-hunting loop that consumes lessons learned from the previous incident and feeds new detections back into monitoring

State the metrics you would report to leadership after an incident and why each one matters

Build a threat-intelligence requirements list tied to the assets and risks you actually protect, rather than to feed volume

Evaluate two intelligence sources for relevance, timeliness, and confidence, and document why you would or would not act on each

Map a control framework (e.g., NIST CSF or ISO 27001) to your technical controls and identify where evidence of operation is missing

Draft a risk register entry with likelihood, impact, treatment option, and residual risk for one real gap you found

Explain how regulatory or contractual obligations change reporting timelines during an incident

Complete two timed full-length practice exams and record per-domain accuracy

Re-study only the two weakest domains, targeting the specific objectives missed rather than re-reading broadly

Recite from memory the standard sequence for evidence handling, incident phases, and vulnerability prioritization

Build a one-page recall sheet of formulas, frameworks, and decision rules you repeatedly missed

Simulate explaining three missed questions aloud to confirm conceptual understanding rather than memorization